Velaya · Travel with confidence
Privacy Policy
How Velaya handles enquiry, booking and website information, and how to exercise your rights.
1. Who is responsible for your information
VELAYA M.H TRAVEL AND TOURS is the personal information controller for information it processes to handle enquiries and coordinate bookings. Our address is Stall #3, Pops District, Sitio Lugadia, Corong Corong POB., 5313 El Nido, Palawan, Philippines. Contact us about privacy or your rights at velaya4info@gmail.com. Independent operators and payment providers may also act as controllers for their own services and records.
2. Information we collect
Depending on your enquiry or booking, we may collect your name, email, phone or WhatsApp number, travel dates, number of travellers, booking preferences, hotel or pick-up details, communication history and transaction information. We request travellers’ ages, nationality, identification details or an emergency contact only when needed for the service or a legal requirement.
Dietary, health or accessibility information can reveal sensitive information. Please provide only what is relevant. Where required, we seek specific permission before collecting or sharing it; we do not treat agreement to a general enquiry form as blanket consent for sensitive data.
Our website and hosting services may process technical information such as IP address, browser and device information, requested pages, security events and server logs. Our Cookie Policy explains the website technologies identified during our review.
3. Why we use it
We use relevant information to respond to enquiries; check availability; arrange tours, transport and pick-ups; communicate with you and operators; manage payments and invoices; support safety and accessibility arrangements; handle complaints; meet legal obligations; protect the website; and prevent fraud.
Optional analytics or marketing must have an appropriate lawful basis. We do not make marketing permission a condition of sending a booking request. We do not use the enquiry form for decisions based solely on automated processing that produce significant effects.
We use participant ages to calculate applicable child fares and reservation deposits. We keep the agreed booking amounts, discounts and payment records to manage your booking and operator settlement. Deposit amounts and free date change deadlines are described in our Terms & Conditions and Cancellation & Refund Policy.
4. Legal grounds
Depending on the activity, processing may be necessary to take steps you request before a contract, perform a booking agreement, comply with legal obligations, protect vital interests in an emergency, or pursue a legitimate interest that does not override your rights. Where consent is required, we ask for it separately and allow withdrawal. Sensitive information requires an applicable legal ground for that type of information, including specific consent where required.
5. Sharing information
We share only relevant information with the selected tour or expedition operator, transport providers, accommodation or activity providers where included, payment providers, and service providers supporting hosting, email, communications and administration. Authorities or professional advisers may receive information where required or lawfully necessary.
Before payment, we identify the operating company for your selected service. Ask us if you need clarification on who will receive your booking details. Please ensure you have authority to provide another traveller’s information and let them know about this notice.
6. Overseas services and transfers
Email, messaging, payment and hosting providers may process information outside the Philippines. If you choose WhatsApp, its service and privacy terms also apply. We use appropriate contractual and organisational safeguards for transfers where required. Where GDPR applies, transfers outside the EEA require an applicable transfer mechanism or lawful exception. Contact us for information about the safeguards relevant to your request.
7. Keeping and protecting information
We keep information only for as long as reasonably needed for its purpose and applicable legal obligations. Retention depends on whether an enquiry becomes a booking, accounting and tax requirements, unresolved complaints, legal claims and required record keeping. We delete or anonymise information when it is no longer needed, subject to lawful retention requirements.
We use access controls and proportionate security measures, and limit access to people who need it for their work. No online service can guarantee absolute security. Avoid sending unnecessary identification, health or payment details through an initial enquiry.
8. Marketing, photographs and children
We use direct marketing only where legally permitted and honour opt-out requests. You can withdraw optional marketing permission by contacting our email address. This does not prevent essential booking communications.
Booking a tour does not give blanket permission to use identifiable photographs or videos for promotion. We seek appropriate permission for that use. Contact us to withdraw permission for future use or raise a concern.
Bookings involving children should be arranged by a parent, guardian or authorised adult. We request children’s details only when necessary and apply any required guardian consent.
9. Your rights in the Philippines
Subject to applicable conditions and exceptions, you may request information about processing, access your data, correct inaccuracies, object to processing, request erasure or blocking, and exercise data portability rights. You can withdraw consent where processing relies on it, without changing the lawfulness of earlier processing. You may also seek remedies and complain to the Philippine National Privacy Commission.
Send requests to velaya4info@gmail.com. We may ask for proportionate information to confirm your identity and will respond within the period required by applicable law. Learn more from the National Privacy Commission.
10. EEA travellers where GDPR applies
Where the EU General Data Protection Regulation applies to our processing, you may have rights of access, rectification, erasure, restriction, portability and objection, including objection to direct marketing. You may withdraw consent and lodge a complaint with the relevant supervisory authority. The applicability of GDPR depends on the circumstances; nationality or visiting the website alone does not determine its application.
We assess requests under the law that applies and explain any lawful limitation. Contact velaya4info@gmail.com to exercise your rights or ask about a transfer, recipient or retention period.
11. Updates
We update this notice when our practices change. The date at the end identifies the current version. Material changes requiring new information or consent will be handled before the affected processing begins.
Questions? Contact velaya4info@gmail.com or +63 969 610 7849.
Legal & Business Information